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In the claims : 

The claims are changed to be as follows: 

1. (Currently amended) A system for providing an analysis of use 
in managing risk, the system comprising: 

a) a knowledge base, for maintaining gcnoric riok rccordo, — a 
generic risk record including a plurality of different fields at 
least some of which have values based on experience gained over 
time ; 

b) a data store of profiles, for maintaining a profile risk 
rccordo record associated with a particular profile and - — a 
profile riok record including the same plurality of fields as a 
the generic risk record, the profile risk rccordo record for use 
in providing a risk assessment in the associated profile; and 

c) a risk processor, for updating the generic risk records 
record based on the profile risk rccordo record in the data store 
of profiles; 

whereby the knowledge baoc includco generic riok rccordo at 
least some with of the field values of the generic risk record 
are that can be refined over time oo ao to be uocful — in providing 
a more accurate riok aoocaomcnt in any particular profilc based on 
values of the corresponding fields of the profile risk record . 

2. (Currently amended) The system of claim 1, wherein some of 
the fields in the generic risk record or the profile risk record 
ficldo are measuring fields input by the user, and pome others of 
the fields are calculated fields calculated by the system, and 
the system allows different modes of analysis in which the fields 
that are the measuring fields differ. 

3. (Original) The system of claim 2, wherein the modes of 
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analysis include: 

a residual assessment mode, in which a user selects inherent 
values of likelihood and consequence for a risk, and a value, for 
each control for the risk, for effectiveness in either preventing 
the risk or reducing the consequence of the risk, and the system 
then calculates residual levels of likelihood, consequence and 
risk rating for the risk; 

an inherent assessment mode, in which a user selects 
residual values of likelihood and consequence for a risk, and a 
value, for each control for the risk, for effectiveness in either 
preventing the risk or in reducing the consequence of the risk, 
and the system then calculates the inherent levels of likelihood, 
consequence and risk rating for the risk; and 

a controls self -assessment mode, in which a user selects 
inherent values of likelihood and consequence for a risk, as well 
as residual values of likelihood and consequence for the risk, 
and the system then calculates the effectiveness of predetermined 
controls needed to either prevent the risk or to reduce the 
consequence of the risk. 

4. (Currently amended) The system of claim 1, wherein the system 
can be used in different modes of use, and further wherein only 
some of the fields of the generic risk record or the profile risk 
record are required to be used in the risk management analysis, 
and which of the fields that are required depending depends on 
the mode of use . 

5. (Currently amended) The system of claim 4, wherein both a— the 
generic risk record and a — the profile risk record each comprise: 



-8- 



Attorney Docket No.: 2-591.5 
Serial No.: 09/774,538 



a) a risk component, for indicating a risk, for indicating 
an inherent risk rating, and also for indicating a residual risk 
rating ,- 

b) a cause component, for indicating the cause of the risk; 

c) a consequence component, for indicating a particular 
consequence of the risk and the an inherent and a residual cost 
of the particular consequence; and 

d) a control component, for indicating a control, for 
indicating whether the control is corrective or preventive, and 
for indicating the effectiveness of the control. 

6. (Currently amended) The system of claim 5, wherein in one 
mode of use the an inherent risk impact cost is aggregated over 
the inherent cost of each consequence of the risk. 

7. (Currently amended) The system of claim 5, wherein in one 
mode of use the residual likelihood is an aggregate calculation 
based on the effectiveness of each preventive control acting on 
the an inherent likelihood . 

8. (Currently amended) The system of claim 5, wherein in one 
mode of use the a residual risk impact cost is aggregated over 
the residual cost of each consequence of the risk. 

9. (Original) The system of claim 1, further comprising a 
scripting facility for enabling a user to create a script 
directing how a risk management process is to be performed, the 
script indicating steps that can be used in performing risk 
analysis in any profile. 

10. (New) The system of claim 1, further wherein the risk 
processor also uses the generic risk record to provide initial 
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values for the profile risk record, whereby the profile risk 
record has initial values based on experience gained over time. 
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